PT-2024-20529 · Typo3 Cms+1 · Typo3/Cms+1

Derhansen · Published 2024-02-13 · Updated 2024-10-18 · CVE-2024-24751

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions sf event mgt versions prior to 7.4.0

Description The existing access control check for events in the backend module of sf event mgt, an event management and registration extension for the TYPO3 CMS, got broken during the update to TYPO3 12.4. This occurred because the RedirectResponse from the $this->redirect() function was never handled.

Recommendations For versions prior to 7.4.0, upgrade to version 7.4.0 to address the issue. As a temporary workaround, consider disabling the $this->redirect() function in the affected backend module until the upgrade is applied. Restrict access to the backend module to minimize the risk of exploitation.

Exploit

Fix

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

CVE-2024-24751

GHSA-4576-PGH2-G34J

Affected Products

Typo3/Cms

Sf Event Mgt

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24751.json · Exploit
• https://github.com/derhansen/sf_event_mgt/commit/a08c2cd48695c07e462d15eeb70434ddc0206e4c · Patch
• https://github.com/derhansen/sf_event_mgt/security/advisories/GHSA-4576-pgh2-g34j · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4576-pgh2-g34j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24751 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24751 · Vendor Advisory
• https://github.com/derhansen/sf_event_mgt · Note
• https://twitter.com/CVEnew/status/1757474380609683718 · Twitter Post
• https://t.me/cvenotify/98796 · Telegram Post